An NFID Foundation strategic positioning paper

Beyond Credentials: A Trust Framework for Identity‑Based Physical Access

Published
31 October 2026
Length
57 pages, six figures
Format
PDF
Author
NFID Foundation Working Group Lead author: Kabir Maiga

Supersedes the Foundation’s 2023 publication.

First page of Beyond Credentials

Abstract

Governments have issued digital identity to a large and growing share of their populations in the form of mobile driver’s licenses, digital passports, and national identity credentials. These credentials are cryptographically signed by their issuers and presentable from a phone. What the access-control ecosystem lacks is not identity but the infrastructure to consume it: a trust framework, attestation formats, a governance model, and a registry that together let government-issued and ecosystem-aligned identity be used at an access decision point safely, privately, and interoperably. This paper describes the NFID Foundation’s work to build that consumption layer. It sets out the architectural move from deployment-side credential issuance to trust-framework verification, positions that move as an addition to physical and mobile credentials rather than a replacement for them, and describes the four technical contributions the Foundation’s working group has ratified: an access attestation envelope, a verifiable registry, a dual-path trust model, and a CBOR encoding profile for access devices. It describes the operational properties (privacy, revocation, audit, and offline behavior) that the framework is designed to guarantee, and explains how the Foundation’s work aligns with ISO/IEC 18013-5 and 18013-7, the Connectivity Standards Alliance’s Aliro specification, the OpenID Foundation’s presentation and issuance protocols, the W3C Verifiable Credentials Data Model, and the other standards that make up the digital identity landscape.

How to read it

The paper is about sixteen thousand words and is not designed to be read end to end by every reader.

  • Standards bodies, working group members, and the identity ecosystem The full argument is in Sections 1, 3, 4, 5, 7, and 9.
  • Enterprise access-control architects and integrators The operational substance is in Sections 1, 2, 3, 4, 6, 8, and 9.
  • Investors, analysts, and ecosystem partners The positioning is in Sections 1, 4, and 8.

The executive summary in Section 1 stands on its own for any reader.

Contents

  1. Executive Summary
  2. The Identity Landscape Has Changed
  3. The Gaps That Remain
  4. The NFID Foundation: What It Is and What It Is Not
  5. Technical Architecture
  6. Operational Properties
  7. Standards Alignment
  8. Implementations and the Path Forward
  9. Security Considerations
  10. Acknowledgments
  11. References

Appendix A, Glossary. Appendix B, The 2023 Paper and the Evolution of the Foundation’s Position. Appendix C, Figures.

Figures

Six figures from the paper, published openly. Each may be reused with the credit “NFID Foundation, Beyond Credentials, 2026.”

Figure 1. The standards landscape: each architectural gap, where it is addressed today, and the Foundation's position relative to it.

Figure 1. The standards landscape: each architectural gap, where it is addressed today, and the Foundation’s position relative to it.

Download PNG
Figure 2. The trust framework layer model: the Foundation's layer between credential issuance and access infrastructure.

Figure 2. The trust framework layer model: the Foundation’s layer between credential issuance and access infrastructure.

Download PNG
Figure 3. The verifiable registry: a resolution layer over trust sources that remain externally operated.

Figure 3. The verifiable registry: a resolution layer over trust sources that remain externally operated.

Download PNG
Figure 4. The dual-path trust model: ecosystem-issued and NFID-aligned credentials, each resolved on its own trust path.

Figure 4. The dual-path trust model: ecosystem-issued and NFID-aligned credentials, each resolved on its own trust path.

Download PNG
Figure 5. The end-to-end flow: issuance through presentation, attestation, resolution, decision, and audit.

Figure 5. The end-to-end flow: issuance through presentation, attestation, resolution, decision, and audit.

Download PNG
Figure 6. Revocation propagation: the issuer-side and access-side paths, and how they compose at the access boundary.

Figure 6. Revocation propagation: the issuer-side and access-side paths, and how they compose at the access boundary.

Download PNG

Cite

NFID Foundation Working Group. Beyond Credentials: A Trust Framework for Identity-Based Physical Access. NFID Foundation, 2026. https://nfid.foundation/paper 

@techreport{nfid2026beyond,
  title       = {Beyond Credentials: A Trust Framework for Identity-Based Physical Access},
  author      = {{NFID Foundation Working Group}},
  institution = {NFID Foundation},
  year        = {2026},
  month       = oct,
  url         = {https://nfid.foundation/paper}
}

The 2023 paper

This paper supersedes the Foundation’s 2023 publication as the canonical reference for the Foundation’s position. The 2023 paper remains available as a historical record; Appendix B describes the relationship. The 2023 paper is available on request at contact@nfid.foundation.